01303f3d78e7e192e9ef77d527e87fec2afb6b3108f7cc10ffeac22b8c86b0a3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260721-c3mgeset2s
SHA256 01303f3d78e7e192e9ef77d527e87fec2afb6b3108f7cc10ffeac22b8c86b0a3
MD5 720c4d8ed833a2cec934b08d47c93978
SHA1 313d2335e07d46f76349dbd6684ea75343cccf17
SHA512 ac3daaa1f641a954dc3b3e8c55057f4896d048ede485ef97963a8c34e1b0d96f58dfdff24bcd5560abb7df15d992367ed9615bb818e5f7e2b9e78ebd6c09635a
SSDEEP 24576:yvrHWdZcy2MDmWbryQHzLlTMV87BbkjCMvGdLtqFyRW+HcitzVYb9:msUOmQTpTb7mGVtJoOrzV+
TLSH
T17175AD1277E58035F1B36731993A93149ABABCB29839840E73DC666D2F70691CE34B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4008	alg.exe
3984	GameInputSvc.exe
4636	GameInputSvc.exe
4072	elevation_service.exe
6064	elevation_service.exe
2176	maintenanceservice.exe
4684	msdtc.exe
3420	OSE.EXE
3208	PerceptionSimulationService.exe
2000	perfhost.exe
2404	ReFsDedupSvc.exe
1984	locator.exe
1536	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\37f3e82de62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	GameInputSvc.exe
4636	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4484	2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	3984	GameInputSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4008	alg.exe
Token: SeDebugPrivilege	4008	alg.exe
Token: SeDebugPrivilege	3984	GameInputSvc.exe
Token: SeDebugPrivilege	3984	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4636	3984	GameInputSvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_720c4d8ed833a2cec934b08d47c93978_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a08553d32d1682e962b9f1aa14e880adb7360ac18b2335fc242b2d1a8c57f23
MD5 d06aea47bf138e519bd236626b1fa2d7
SHA1 5919c115bc87bf87b65a9ed08818657bd7365cf8
SHA512 6c7df60cda14866844352ee594dd93aeea015602d6dd09c297163cded060e5d401b030e9e71780723e2208f7d5c9ccaadfbdd86bf84817ac9162ef02bece0c2d
SSDEEP 49152:4cz632BuPkFKRrdE6oh7stBhuXjfS4LWxnJoOrzV+:+3q6gjBTO
TLSH
T1A9D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ddf994b4918ece96ca9bf39af48c3156f40311043be57466a43713cc9c4e5f10
MD5 0f1fe95284d3dd1c5d2ebcfa09b1207e
SHA1 ebd76c10573a492fa7c6a33174232154b598e31d
SHA512 f6717a1127d8eb5c6938b0707c6932d2ef38287debb8f8761e74a8dc34ddc223ca14c5b9d7ed9fdd93f73f9865d72686cd217e1471c0854940d13a38f937746b
SSDEEP 12288:P1XLsis8kxgC81flczAcy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:tXYpZcczAcyRW+HcitzVYb9
TLSH
T1BE05011977E009F9EC678179C8A28512DB73BC458764E78F03E49A251F233D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 90cbb0079fe3feb1bd70fbff2bc12633f2a95add0a0596f6279683b9a71ef188
MD5 b47899a27837da492646d467df4d5f21
SHA1 62ef28fcb8fc798379cf9fc0ab44b0dcc7b012ff
SHA512 ebc6f373d93c2cf78a77a00ef613ed655095bf0d3bd1ac38f30119e22cc852f2027d510bcda5dca9ab6711ce2bfe3fd7a0e6152951ac941c871e8a64a31f478a
SSDEEP 12288:SwJNYVSeKU310h9N6dS5xpGZIVuhrHsIy2Oqi2U9y3+HqFijRXeR4JCQV/qD8Pm9:j0SeB310hlxOrMIyRW+HcitzVYb9
TLSH
T12845AE16F6748731D073C0B9C5D2A68AEE7230865B308ACB4286D77C7F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cee6b52ad4199b4b40ebaf87bc2fa5a50d53e6043fe1d4e32548442d0af7c5eb
MD5 bd25ffb6d43392d57fa67becf28d0241
SHA1 bcabf8e73240003a05ac67d6f565ea996e4fe35b
SHA512 7d707ddcb606303084b118e56b62a3cd5092a3d780ba572cb2ae8ed1786453bcba743027e5817fea80cb249f8178a34594e0b07b0f015c5b24a063a5c3e8f4e3
SSDEEP 24576:4Vm/ezSC6vUyD/aqgrvW/6q8wyufyRW+HcitzVYb9:l/ezSC6vUzPvuHjyZoOrzV+
TLSH
T16B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 4f1e049028d287728c4c8351ff50a2df7d492d456d78c4fe41c301f194ce0c8a
MD5 f13610acd25e65b64e65cfd41b4b4290
SHA1 fee9ecd5ec4c0f98b5e9b832f7628f16ab8d5dd9
SHA512 d044a3d6da4736e365ade0617be53aa448aca495a53e77254c2cd7df474e0d0d1045182453076e1d8b30232b9dcea88061f64f940e4a2360bbb117e2889df1a1
SSDEEP 12288:5aJjBK33vrSPth+l1D0mPwEBoW/lx4jf0Im981y2Oqi2U9y3+HqFijRXeR4JCQVc:5abKPrktqT/l+d1yRW+HcitzVYb9
TLSH
T137559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 5eccbb6c04e94ba6ecc7cb26973adf95dce95336095f90908c1bac94059cdf7e
MD5 67650be034c95f0b2e4ac04d46e45d8a
SHA1 d9eb92cd1e77209b61e6acd80d2541ed986f3c10
SHA512 0ea1eff3e5891e644c19944b6022069abc713425cd39bc35fdfe286e0828b46cc8623daab64a98ed72de52027ad7751fdecb5be7df25d1a4a6b931daaa5cf492
SSDEEP 12288:ALvy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:ALvyRW+HcitzVYb9
TLSH
T12FD423879F308991F95528B1F9A30E438BA4FE88CB6CD95E53AC67245B730D9F6021C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 a30b61544a67e61b3aec06e36ad61d22f1125943fda9fb92843bdb2c8c8de751
MD5 e7a4cf7d22bdb6189dbded6db53c6a00
SHA1 94b04ebf183cdb425db9885c78a0f9342d0cc160
SHA512 bc20eea9cf4ce71d352342546165d930354f517d75a85cb509b2d4f5dc9c89de90e2f7adcefe6e72e2f211d04c1933c1a825715874c00735e0548d341a977834
SSDEEP 12288:MeBNUbTVO86Uoy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:MJIUoyRW+HcitzVYb9
TLSH
T1F015CF6BEE38FCD2C27A9DB95A918600D77278708F61A3CBD264830DDE235E15E36C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 d7b3cdf2a6c4b9a80aeb1f01d195201ea289e6322bd086af41e123c2ec2aa711
MD5 1b3de46f9d49946191275c7923653d8f
SHA1 8df5745b9ffa8ba7cc1255cac16a4ff9e01d21b8
SHA512 36593a3be4f8da3d9caee4c7f8dbb7686aa9a95e4edfdc237456d1ad11d811f9ae72846bb06b26494c0be59a2584046a119e9cbfc067d5885e03ea75329d92e2
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THL:VQvGAdlCEL8c/9RNw5CwO
TLSH
T11A367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 9c29056836d71e355f2b558210661c66751a01671ad6ab170312f55608a912c5
MD5 55616bb6d66cb1f64715e7eb5ff09066
SHA1 5b66a61fbb88071fa72f6e5005b27ba2ec3a4565
SHA512 c47748e7abf468779b546884edb65ef27082ce55a0f30b1166a1f7afa043fa14b1b0fc4c3b51639032af9aab015f82409fe8862420db533920484f62a4e358ae
SSDEEP 12288:xxwSfxL/2Dc3bDLLmt0LDQewsAjJy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8Am0:7mewsAjJyRW+HcitzVYb9
TLSH
T15515E031FF74D436C67B0DB22B26C716587CB9608B6119C3E3E88E9D5A302D22736A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c40e0a1680cf9d75483515e13676ef2ba0f7410571c5565c3a67988e5562d049
MD5 ba0aa4f65b4d93c271dbb6102bdc33d3
SHA1 d018e098777b800fffbf0848dba26587e698e021
SHA512 53130e60bf1fe5405d8ba3c8d4ff98998008f70135aae027b5337fd6c0bbf79be6a976b18baa51c3a6f3993d7238d1bd353f9db84807e4a07081273a09cec971
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH9:HUEtQevvqc2W1cpV2XF32
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d1de82d46b5de18ce04acca8e3c5253dada0e70fa4ed3787e22e4d99e73942a
MD5 5301836af0ae064509d67e042ab7cefe
SHA1 e4abe9b9dc7fa45fcb12eb607c48f36fd7d18106
SHA512 9b4bdb898a5adce673ded2401069ce2b16f2127aa65c51e12546874ddc3b663959b46d8e7ac61dbef1f978eae552595eed54cfa5a0ed77f119b4ede9b2ef0dd1
SSDEEP 49152:Gh7RquA/m2yL5zMfFiV+XenmE3/zioOrzV+:Soq1VjnmiO
TLSH
T166D58D0976B8C2E4D1F6C77886A2C647F37178158B34A7EF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a688047ccb3f621e3cc70c6f01a02a6239eff3cf941dcddbf99056277da16086
MD5 d9789cdaae9daae863da69f7404413f5
SHA1 6ca686765451aeb055a3c7ed5346b7f6c3b2c25a
SHA512 a14155fb438546e02425987613099d1752bf4b674fff17ed43b316b8371db7d8982a2c34a8cca6629f82b99ace3321bc3e812dccb7462cd6eaa08e8700f34d70
SSDEEP 24576:RAhGLvdFoiwtA5l7S53/yRW+HcitzVYb9:RAMpFoiq5aoOrzV+
TLSH
T1A945AE81EBF945D4F5B3AAB899B68571EA76BCA95E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 1868ef514adaf7fd594c40c85f4120c32ed8d6addaef20ccb39b3c7265859928
MD5 a5ed021ce023539ba95352700992c6d5
SHA1 8fe18b8e48b7690446e62d06a3d9f69ba5d11e4d
SHA512 6ffbdcb46340c065428d53ab0f7a1337d14e3e1a0bf16e2444c527b7e0a39b7ed8ca4b5e54d5ec4abc95b4b5e4d9aba88fc657a27503ce78258338d1c625d5a4
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+Cpy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:QwuuOWKyRW+HcitzVYb9
TLSH
T19A05F14A77B40CF9E9A78139C597C532E7F2BC012A25DB1F1360C65A6F33261BD2A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 334aa51a08cd12ab7e323532b55f7cc0f2fd3cc20812ecd883df9f3a155272b1
MD5 1d266705158fba878579b35263b6cf97
SHA1 68d9675348ac6b30ae08b5df4c76f8c5d18cfe97
SHA512 5c1643a8bb5a183cdb8a55c08173b163edf89f2b7739333001a8448032ea1858b2591fb21973e3dbb5c9cdedc629b547aeb6b2120300615f6f5c3c8d8d4d8d96
SSDEEP 12288:ppY1Idoy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:TYuSyRW+HcitzVYb9
TLSH
T13EE4128B2BB461F5E1975178D9E24A43C7B1BC86E73583CF136843681F23AC66E35362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 529487bb3259cd4b2680bec6e871ecba8a4e5ebf0d29a08ad6450c409d0c3b60
MD5 126509a196c066126e28bd0227556b55
SHA1 bc59109c47f97b4262caf47b3a649c0bbb23193b
SHA512 2513d71e2bdb033d5051e58e4589204ac56ffd3f3e952cfb568aef9b4d94fe8fe661dbc85f26581e6b45c9521a511a377a718d187f2af2ea8ff88060a4bdb5d5
SSDEEP 49152:04Qdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uz:qQRQyi36YOcP8Lvw2gAf+PN3fO
TLSH
T16A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 be759071da7c70c3f1debdba4cd96adaa083740f86f2d43ae42ea1ed4f645292
MD5 56ae32e936dbb5465b0c64b2dd14a93f
SHA1 28b5c0ff462f252d36b40a090730aafe6ce43d58
SHA512 9eed94cddcbf5a8d3b3e4d6dd02f1c2e6367007f0f18d9047941d73f9d486779ebccef7360817e6b7d87cc1b44dbcb4c25ee067ced1fc9ce5038f9dc986ff84f
SSDEEP 49152:04Qdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U/:qQRQyi36YOcP8Lvw2gAf+PN37O
TLSH
T1CD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 afb69b24f9f26f819bc5c3678dc7d07035e4e325a785da9caed418a54e24e438
MD5 ad8282e8b540719fa1dac12b62049e0a
SHA1 3912a4248e95c9669c255ac918d9b01d8c4cb551
SHA512 9a0203a65571db141e86b819dc7578d6d9fa8efafc510e6f7ecd5e0a22f386477d0a68af705c0fbd13a8d3cdd12ae172259ae18efdd9dffb4486fba4c147dac1
SSDEEP 24576:xwvqRf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0dyRW+HcitzVYb9:T68Qg55nhMeWu7PNU3/toOrzV+
TLSH
T163B55A33B2F200A9C44DE1769F4A872296D17C75CFE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3dfeb7bb73a1054a13fa99fe5fa8a867095a9c97ac002d5d1909fd8bce2392c6
MD5 c59b5fc5e0a1302bfec98ad43da13535
SHA1 0af1f7cb152c3fe38a923edd82a2dba39e547eab
SHA512 eb209d26a1ad5d518f2ae0eaae102d3636d88e5fa36618d8d689579a9ac286ca04f28821aaafc57e8f16985bce975ed201a51565bfadd8f3b18b8ff0241030f5
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk991:fy5112gYy5azzVv569nLKnhZSO
TLSH
T1CA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffb38172e37ed0791256b4dcde2a4d73d7594d1fbd0b5fa9958ad264faa8f52a
MD5 26171c5b3ecf91c4735923aa37028891
SHA1 e2b70e79c9531d8339789ad6f5bffc4992c0f82b
SHA512 b27c9f76d654e06b0c39e685d9b613ba78bab5ad64b8a9129a0e26572f9d19ff13c9d6a8dd45fb2a031353c212a4edbce1ccf2d59b3c7f77446a2f9b8a4acb0f
SSDEEP 49152:Le+taZ3usBWOBr4tEGp0bqx0z+n217aau1glaoOrzV+:au6JmTxd2dvO
TLSH
T1BCD59D13F2D901E8D06ED478974A9233EA62BC494B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8246b14937dfcd772a7ead56ebe5be19947c3511deb5030bd0313ed7a53ff89
MD5 661b88803cd99a8bff87821acba1f91a
SHA1 1a71a16b28c9a3a2ad08c1ba68b4282f3c698ade
SHA512 129ac67d9125298124e026dfc245c594bc5a7b660b3a0af701e043c108e74ba62f463ee52f11d69b317beb4ed3a8812e21a3131daa16badf1e1987c39f51ed57
SSDEEP 24576:ThvME1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3YyRW+HcitzVYb9:t1hpsNoJpF1A6UU44CwH7R4xxoOrzV+
TLSH
T197B5BE13F2D801E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 91c78c00f925d95ad7b9045cb9cd9475a20360b468db3147401e90d74c53d4c0
MD5 4aa9b88eceee5158026bcf3d0f1512ff
SHA1 6d309bfb8a58b1a342791b3b8f093d90fc60d2bd
SHA512 4eb6663a06bc16ea2e41a091606c42c4b84d1c6a2a898dde9076b427138a454868a24105b4a9e7c6f32be838a637199f47506ebb83313d49f82a8f7251fd6a5a
SSDEEP 49152:3SuZQIY0Be2K6RVtOnks6NMHqUoOrzV+:t5dKoi61NO
TLSH
T195C5BE03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 379f0003ef755ea69cb2ebb8cdf18efe89a1ac6b9d7e40360cc04659bb2b73c5
MD5 052d7a2a8f136215424d1bbf7d2da455
SHA1 134bac2cb5e95ce97be477309682fa7781e8ad1d
SHA512 f7ff3e0bef91449450d8d0dd870cdbbe89201c4321d043196c7fe6788d583d613ec44d692287b2a8ed3ac1db1539ec3fff6deb075224a34606ab7009a1060ab1
SSDEEP 49152:M6lSn8EApI0figTgiDn0AP5w4T73GUBNoIOWvL:0X2iyphdT7xyItL
TLSH
T109A5BE13F2D900E8D05ED078C7568632EA62BC150B39B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 603KB
SHA256 6adbd5335b492e86433cac9c81df359db567c1974f90eac8e684e0b8d21ef0e9
MD5 0297d12570932983c5d16531a0c012e1
SHA1 5ca5aab4d8f502374039bd67cdab46daf9a88758
SHA512 a56892494310c375e5e5e37d3d4381fb6b558dbe5ce2ccf5796e947150addbb17597d15fe849934aba11edf1bb2fcd84dc3370acb0477a8fcffe7fa65c09cfa7
SSDEEP 12288:+FX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:+8ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1E4D423933F54C2A6C329C4FD8E73AB694797767AD099D387D619C8422F3A411903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 603KB
SHA256 99b21b315848d6dc7cb52358862eb0211c4a50102a7b52b256d124430c33b215
MD5 bbb6d28fe410c219e43d26d88a96e08e
SHA1 9b1dcd1c2390ef6ec92e9d826bea5d69bdd2057a
SHA512 7664b99482c015704907dd8867fbc6aa58af7e46c065ec248043a055b3e7a7a77b399ddd430b572fefaf2ff6a9f84e6f93720110c419716d0401f5f8e4225025
SSDEEP 12288:cvX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:cuftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T180D423A33F54C296C329C4FD8E33AB698797767AD099D387D619C8423F29411903CACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 603KB
SHA256 b1222224eb74f7bc7d764336cb870523bdee59e0136f5124424b5a9c750fc100
MD5 3585dc681b7fa5953285252ae3e315b9
SHA1 0853a82d1145b0da323c364a1536e4914d01f112
SHA512 ead64d3845cd3e24ab3d2583e8cc40ceca115cc137765479d0add0ef2014002b5a7964591121813294949fd3030a56a3a2ca0f9c1476605cceb86df24c3d2823
SSDEEP 12288:eBX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:eQftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T156D423933F55C196C319C4BD8E37AB6987A7767AD0D9D3CBC619C8423F2A411903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 9ca9406a8e85a602852c9ff2380817e871abf554237f30537887d4661931c6e2
MD5 1247fde2ed7fae474f8977bdb8f1e69e
SHA1 0ba90ce09ca0619bbc5ea8075d40327c6d1367f1
SHA512 74a89e1464f2823fd5e09c03bee5833e251221347d01ebb56dd593f0aa1cd0d5f1eb9c9059887d6613466fc5594f2daf29554a16b437062eda24f510d1622d51
SSDEEP 12288:FlCX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:1ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1CCD423933B5881D1C62AD0BDCD739A6593B7B9BAD175D38FCA0088862F36610953CBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 603KB
SHA256 32a73bd7294b3b20e5291b9fb2263940df6fa0db348a050aacaddd48ec3f652c
MD5 ec0e9e548c950f845c3fef6f8d16a2f1
SHA1 2c767dc10a6bb5c0e216b982aa0206a67a899f55
SHA512 050e3e48476d208bbee8fdaecd7fe173d0978040673aaca4ffdb2bfedb1a6ccb2f0dbd30c4a6482eeeb8610d1807570f0f95c0e14a35d6f05e0c383fc9bf0c17
SSDEEP 12288:F9X4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:FUftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1C4D423A33F54C192C319C4FD8E779B6947A7767AD0D9D3CBD609C8422F2A411913CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 603KB
SHA256 54e18de99cef928bc2458aab18ae235f94e0e9d402b4eb6b8b46e9fa2fe47999
MD5 0c21440ad862043053dae295f42b1950
SHA1 a60ff4fbe1477dd760f83eb48d05310d74e3a5f8
SHA512 a83f0f455fc5e0888508ff2777e4f36559a59bdd3ac4b6e06f163fd9205c047ddd0ae8a1c3782765881f9a811dc8e359d0142e4cbb50973c92ff782ed35deb21
SSDEEP 12288:GHX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:GGftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T184D423933F54C292C329C4FD8E73AB694757767AD0A9D3CBD619C8423F2A411903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 f74e76511786a3eb9a9d59bfc7b2c71d20501881f951583cec0d92c403781377
MD5 0bb4dd2c977d4ef4d5a2f2419ddcea52
SHA1 50a5b161696770c18b06780fedfdc76d5ffbcd64
SHA512 d38b861e14fa86bdd5affd28ff02f8ddb2223eebc8363d7ebad91d30a4c3823aea95cad0644167c679fbc470111e34bb377204b9b31b2a20f1fdcc521d8f626a
SSDEEP 12288:A9X4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:AUftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T16BD423A33F54C292C319C4FD8E37AB694757767AD4A9D38BD619C8423F3A411903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 7d064fb6bb41e0852b8ea3aa6c84796cf7d8d5d3b1395e7061ae3702924c2c1a
MD5 5c83ded574f0d251d3c2eba84a2985f8
SHA1 c722a7907c616ae73d80055887a24cfae3e36b65
SHA512 bcec57d33cf4b5f46dcb994573c617938c86411ff2add4ae1376d53cde08a3c79d5ae80ee0f90b54797d84e17daf752ffdfdd0e7d130b959bbf94c7dd68a3838
SSDEEP 24576:RZMczrhSgTftT736FNKBiMDy5IRcZWvq/qvNg:RZMczVDT73GUBNoIOWvL
TLSH
T1C31501A5739058F8DD67813ECD268916D6B27C6A46B0C61F03A836671F333611C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 02526f8c1847e31f5227d6db828f18b231ef6191c9ba45dfa45539d82960c74b
MD5 70cb5931215881d08f20f65e1bdbd347
SHA1 e64fb916db635d8b3f42affcbfbc6e2e76d989f2
SHA512 372b6fc2d7655afe9c0f28a074964363133ba08321bafbc4b7b9dcb5975f1b515caaee77942fc4238eea098b402278155ee01f77f0bfbbf070bc6c8b7dd79f30
SSDEEP 12288:UfX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:UeftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1B9D423933F54C196C319C4BD8E77AB6987A7767AD0E9E3CBD618C8423F29411503CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 5619508307a04dc4faad444d0b21d0f26e0a0c962e3bbfdf7f0875272ee56193
MD5 84974ac977bf62df09e308866cc99fc5
SHA1 1aa878a92aca498775a0ac6f3c450751e256bd55
SHA512 9562f7e79774c6c0cddff1e522e130ee3c10975fb625ff49486cf46dd7a4f8ab9fe6922e445e55c3b24eab91a66486c410c10f4e19c404f88bf4e03516ae888a
SSDEEP 12288:uyX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:ulftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T19CD423933F54C295C329C4BD8E33AB69475B767AD499E3C7D619C8423F3A412903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 7c64ade37e77fdfd59ff294abacf045002066810656b5cdd89506395c3d53e3f
MD5 5dbc3a24a572e8581aaa678b8b005529
SHA1 ce7f0ac80c370539afe14ecdaa859fe61ea2ad8f
SHA512 ec9dd082d3bb3de8231e8460b739813dbba9f5782d4cde6c04952b798058cf3314ead51c953097c21c2da4b8f73f2ade7f2317489b453cde052437dbf171185c
SSDEEP 12288:hPPz5L8EX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:tzGXftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1EFF4125337A120F9D23A817DCD631A12F372B8364764CBAF536446762F272509E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 603KB
SHA256 67688eb72af1b3f94812c64292d574433ae3fff337cfa325830e207c23bfb205
MD5 78c72a2d3e643b594e831c7953591017
SHA1 973ac0f76127c0c85b26167ce02a404995e1d8cb
SHA512 d7ec14f339d91f959272ed987fa71ac0705b3b1861656e2ad1b8a6138f0161ee1c507e909d22b464879dbcc3b7c41682bbd295313656d787c76648638bb7d6e1
SSDEEP 12288:4pX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:44ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1B0D423933F54C195C329C4BD8E37AB6987A7767AD099E3C7D619C8423F3A411903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 603KB
SHA256 caaccd0911a0900b3a73ecfa5b761d89a09c742d253bd4d17f36a8f9ad7d1005
MD5 07495057b68fc2ac6bc1fbbfb046af4e
SHA1 b79b0b5b5be05877dc298a235528ac95bd74ffbe
SHA512 fdafc1750f6fd372252ab4380a28d4008cf7a5c8d8f1800f5fab46d2249b9620dc94ff561076acdd78946dbeb6b4627c1797a8ed3ed8db08c8cbdd7a64e56484
SSDEEP 12288:8+X4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:8ZftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1E1D423933F54C195C328C4BD8E77AB6987A7767AD099E3C7D619C8423F39412903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 c47a4e72681f9014a13556b072c69da09d712d855a7f73263a1fad55a44b9068
MD5 42de71d46f7aec83e404d518a3bd960d
SHA1 d3022b6d035bd39c629f0bdb91949671ecab08f7
SHA512 76935133dcbbb5ad39053ae4daa17d091a9f290abd9e96e67662d77bc34a39d82781cef454e4315e8be88a172c71aaa2cc108cae97f5471595f8cb62e57777f2
SSDEEP 12288:0PPz5L8lX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:czGcftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1ECF4125337A160F9D23A817CCC631A12F7B2B8364764CBAF536446762F272509D3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 56d29813badaf13a4b03c5884467a0d765638ac5e86dc8ad6b8450cdad874f3a
MD5 6e5d39abdb1b2761ca2f89a4e725bb6e
SHA1 856b77ee7ac3dbda6b44c62d980bbdc75496035f
SHA512 f3aab80616c4858038c9ce2790ab32239cd74bd5dc8beb19d06573b8a2ae56437474e2f776a8d8db927c7e660d87f222942df6aad764d7f8e1785753f898d091
SSDEEP 24576:HTuaLl3z0zDkftT736FNKBiMDy5IRcZWvq/qvNg:HTdLlj1T73GUBNoIOWvL
TLSH
T1BF1501A5735058F8DD67813ECD268A16D2B27C6A07B0C65F03A836671F333A11C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 546eb3c97fab3247fb9fc8c713d22c56bb85342d7de3eaa69439f8ce4587d683
MD5 ff4062d8d9b6a3f4370aa49f7ad89ed2
SHA1 49104009085da4ebb3d1c6036f0c97088e945555
SHA512 1e1bc256912446234dbad7ba2ea93c406750bdf212494357ce14689933fa32c2e7dd7d479baafbbb08e25de9dfec01bed6dcfa17cd46d249be6c1b061d749010
SSDEEP 24576:N3PdACHYy7OSkftT736FNKBiMDy5IRcZWvq/qvNg:tPdACHYyKTT73GUBNoIOWvL
TLSH
T1EF35DF90B3E410E8F1B7CA39CD765511DAB67C6A1B71DA8F03A4651A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 603KB
SHA256 a74b6a5a21fd4c48056fbddb226b5773b3e84a1ef52b1fad90a67c2c8aaea353
MD5 24e8bb280217b49cca94b2a74b986f6e
SHA1 7997b59413fb1febc71a66f8ad7430357308c05c
SHA512 f741d1f62a335f08c2901ff9aff31fcbb17ea31d8b8860936e9f3adad04b940ec856524a409c6ae18d4c8f8d8c835e184bc56fcbc751c3e8d5501976b669f1fd
SSDEEP 12288:wPOZX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:wGoftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T125D423933F54C296C319C4BD8E37AB6947A7757AD099D3CBD619C8423F2A411903CACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 9d57c88d72720758f98d3031683398609d98cbc9f85939cbfe9e27490091c463
MD5 4c8580833e32de4fbb98d25bd9526c3e
SHA1 5d754107591ddc59c1ea0025dc1e15f59b7a8a60
SHA512 dfe6a4c75ed51296f68cf2892a3994721d23eba0189c63653b6b217c681e9594a3f3300e5727d4e10d1d0a1918d961459dbfce780f263dd8963f6a385e78cf5c
SSDEEP 12288:4hX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:4wftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1B3D423A33F54C1A6C329C4FD8E779B654757767AD0A9D38BD619C8422F2A411803CACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 603KB
SHA256 a8053d791916d304cdf689530d631f51c2257cfea7aea805accc9e556814ebfc
MD5 07280984a85d593a3c3538743906a6a8
SHA1 c4d7438bbe05555f8c3799a6f70bbd8ad1ec9fb7
SHA512 7512bc934525190b7f66c58c8cacff5af3a3b7ecf90953df33c778b65d099494bc4836c7670a2bede04ccef18321abd921cb63f90666ce6c53925fe3742d5b7b
SSDEEP 12288:JQX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:JrftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1DFD423933F54C1A6C329C4BD8E37AB6947A7767AD0D9D3CBC619C8423F2A415503CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 603KB
SHA256 9f3e4d7dd174d484e662c2eeb4627bfee11293c44899153d825f604efee1fb51
MD5 a7911e576ab3c70edc12a342629ae6e0
SHA1 812cbd4c7c6dc5f2f82899255667630fbd671dfd
SHA512 d16a073ea000561d7b7796ec109aaadd0e9f4c2dd478f14482bcdddc0641e179d06f47bcd7986f54de97556f128c4c8c16f9b889900c63471aada3b72d975dc6
SSDEEP 12288:KVX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:KMftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T17DD423933F54C196C329C4BD8E73AB6A47A7767AD098E3C7D619C8423F39416503CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 603KB
SHA256 144699f541a70bc404b7525cbcbb5f7deccb3b4e38974221c32f122f42d37bd2
MD5 80bd4fcf8fb01d457839724ca33fe539
SHA1 4746281d48f6eb9f53acb05b46aac6300ef04259
SHA512 82db61afee4800b557f40500462f25559fc43de4717fc1783c1c69df1d6ea85b2fe547659f9c74f2980f854a9a4ee87aa17f592615fc325b5a66da121ef0e1c2
SSDEEP 12288:mwX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:mLftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T17BD423933F54C192C319C4BD8E73AB6A47A7767AD498D3CBD619C8423F39415903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 603KB
SHA256 817986c6da9e1cc594ae3d3129b5d912bdd3493ae145d799e85f86edd38511be
MD5 83116d21482c72e3c8012ed3145ef7c2
SHA1 984792bdc3199cb2147ce20814c7e616da941ecd
SHA512 a7182a821491ded29ccf67c7c9eb8fef0882c8824e91c1eb77dd35654d7c2bb3cfe56e690db770c1ce6294034bdb2a9b8f71ee962a165ea1bd5f7d435540d0a4
SSDEEP 12288:rdX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:r0ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T15AD423A33F54C291C319C4FD8E77AB66479B767AD0A9D3C7C619C8422F39416903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 603KB
SHA256 ee4d1757534eb2badd3d09e9a515dcfb2b5de34aa2b000449441bffff438e325
MD5 3ab52c57bf40bcc9e0dfc2f48bec8a4c
SHA1 d8d13212b7a6018bb33add4c809627f94ef407a6
SHA512 c6597ecb09729a8d0c56b34d53258cf9d02bbcbce923e22987fd6f91ee40d1d1250f5e43ceb0105f1cc956640c5ec12e906c6b8578e797f0ac6ad8d80047700f
SSDEEP 12288:g7X4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:gyftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T19DD423933F54C292C319C4BD8E37AB6A47A7767AD4D8D3CBD619C8423F29415903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 603KB
SHA256 090e20cf3fc63fce8bb3268a761ebb2a216a74d15f9639986369c6bb98045a3c
MD5 6f2ae31b12c234791b38ec5ade63d30e
SHA1 5fd0e91a859fdb3b5898c8b68b9483e49594358c
SHA512 cf7fc83896025f77f9bfaba28509d8749b50dba3a78c1e96b209fe843c3676fd81ce5e4ed780e18bb0bc404fc87adef327ded1134b2cf63158db9810453f9045
SSDEEP 12288:3kX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:33ftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T1D0D423A33F54C291C319C4FD8E779B66479BB67AD099E3C7C619C8422F39416903CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 603KB
SHA256 a26584f29d1992afa7dd8e24ca44f68cb2f1d3a4bb76e829ebe2b0dc24264eac
MD5 4c3e15abca4c2bbdb1bd3a85f681098e
SHA1 19f2e627a3ba8e32250669786b82074a6e45393e
SHA512 9d1b3b0931ed691872d664ad4a72105fd154af0ae65ed5e70abd972f2d36918704b44f05529ea765b069d0435a2d9687abb257d757007193d51ebb57755b127c
SSDEEP 12288:VMX4xpvftlw4736CmQKlviBgVMD8Ao35PZmRcZWRhi2c/qUeIYNR9/Y:VfftT736FNKBiMDy5IRcZWvq/qvNg
TLSH
T105D423933F54C296C319C4BD8E73AB6947A7767BD099D3CBD618C8423F2A415503CACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 d9bf98b0ff77d57ba48819da1e2470de9829d9299ec3ba4fe51e3c4f3aa3ba96
MD5 ba0b24b6b61186910e8fd746f88ff80c
SHA1 46f4c13f12cb2fb3751a341a7e4da41e51e2aa75
SHA512 cdb80d82267ed0f82755de316139dd3ca71c1dc23067f7d907d3deb61cf06f8f89a1953ae75599bd3cdd0a2547b9ea7dc57e6c217fd28dc70a899fb0aa6e7448
SSDEEP 12288:sFwvD5ue64Lk3tRX69qkyAI5/y2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:sFwvtk9RX6wkyAIhyRW+HcitzVYb9
TLSH
T1C135DF2AEFD844E5E0B7913C99B3460AF6B178595B31C6CF029A536D0E33ED46E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 f475da5d1504641ba570af7c57a50828fbde724217b7fe4186e742d45158ce73
MD5 7a3458bdb9fc041c5f265f04564546c7
SHA1 7393bdc5d9760a9f27d55cb793201423ac96f562
SHA512 b68f131ffe8a0a9fbfa6d502dd3438d3f025abbcd6cfdf8d269d7613afafb7f905bb8ef05efd76a7b613d938aeb83c72ad62e14bd324425b8e49eb08feb9928c
SSDEEP 12288:/cOf9y2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:Z9yRW+HcitzVYb9
TLSH
T1ACF4F04AD66402E8D06E61B5CB524A42B373BC55C7E1D3CB53D0F53D1F36290AEEA683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 fab254c9537485d757113853041949a730a3b80eff684abd42ab67d44bf9ed46
MD5 875ebbb9f0c52e632fa718aa273fb585
SHA1 8a06d969d537e5e230c10acacffd35136649b51b
SHA512 a652f399f079bb85306bb77f2477c506a74379559a133cdb43d3bb5637d0c13103dc4a52e8bde73a0795bc71452e6b556614df65cebf7e72d33bef44346e8b16
SSDEEP 3072:iokdkdxlz+PZk7W1wiJq7pz9M1n446zQPFkBgfbFGjj:9AJE
TLSH
T1ACF3328A852FC4FB74238A87C3795CB44593764A535E491932CFD2EEB641903CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 350bcc5eaac46afd38b33c87cd40bd5698c2bcb8d2a23e3c897f60ab35f8b792
MD5 538a1e5c917be9dc8d58b45150a1e245
SHA1 bbacec406eccd2082b09ac2fdc26abd8c19cea2f
SHA512 66acccb8ba26c37eecec7c2b160e3b3c32d0700f76ca6576d00c3e097e78a78cc1bafb59a5f40936c67cf21dda7b47c6619ba5602f1240736d6cad002cc6d147
SSDEEP 12288:Rc7Ry2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:SRyRW+HcitzVYb9
TLSH
T1F7D423479F788E81F86568F0F4574A234759FE88DF68D49BA34C13246B235C9BE212CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 ad504b0bfab30371f89f58d755e56c9d4c0afddb353022dbd913a8f0b28ddfc1
MD5 7d5caed1497b7956449f23acab93b711
SHA1 d79ce30441869ca7b1bf477ebe17c5ad625268b9
SHA512 8bdf5add0ee388a67db176fc678a00dd8d1663f43b5fe678b42c0c62aad91871945df79e4fee40b5d1d8f5fbd95d1567914afef4e024d4d8b7938aa4a18e0d06
SSDEEP 12288:D1Gi+oy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:xGyyRW+HcitzVYb9
TLSH
T169E4234F2BB065D4D839C6B5E4634A53ABB0BD84DB28A5EF03E892348F235E07635DC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 338c50c6f3e7b7af89dbc5b50554b4433a5d9a25c585dc67b629db343b662a65
MD5 ef5f8d412b8371e2b7761d16e5d2bc9b
SHA1 0b3f2bb3538b275da574f81640454e8674a46242
SHA512 4757da73c41ee3ef8ec299a03264b207f95287666274a88697ea6ba37d7bd503d6ccd1a06224204c9bfbc561b04ca3b18d12f7be50bf7eb131fa52297ebe7814
SSDEEP 12288:Fimy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:FHyRW+HcitzVYb9
TLSH
T162D4238B9F348AC1F85568F1F4530F438B94FE88DB68A5DF63AC12245B530DA7A321C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 fbad58dbebb1c22d5903dd6137eda623c3a584ca4023cec4c588fcc2a47292ac
MD5 bfc69ba5b12cfd7e97f4e6cce1218e3a
SHA1 bbe8af6e1b2bbed24b065c2e4eb08f05e39ecb01
SHA512 1694d8e5fc4db3b960338b7525834c9d4051b89cef64bb431cba7ff5f256d4f736f99663ab468d14df0b8fe331a0a21a7f568f87fd24f151623ab3c1ac910c91
SSDEEP 12288:yHvUrBFrEjwaQty2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:yPUr+NQtyRW+HcitzVYb9
TLSH
T16705F11F66B818E5F676E17DC982870AE771B8524711D2CF02E0817E4F63AE8BD39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ade06869f4adc3c4616ba9c5ec51676d1b0e089d21b78ba7957856c8d503c8bb
MD5 8661fd76af3e3fb4054072c2cf5e54b4
SHA1 a3130d69e30b8886279e0daa4c2ea09e439b5819
SHA512 7da48ce1ef1bea8be9a0d56093852e749d45603cf7fa121d8bdf013c5bf292be2e1f6872298c72c2d5cd9b76e7b430ab08864f9ee1467d7a071e5a6a911b5e6e
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXoOrzV+:VG05lO43bPO
TLSH
T1B1D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0274537a3923dd179a46e20f449d3ea792fdd55bbcd2d00896b31ba18add3799
MD5 85dbe61ce9df2c5e13f1dc4014156ee8
SHA1 191d24e9bca09a9b6b03387136cb329b747e65fc
SHA512 331164574cd0a21c127585b39fd861f23a633dd2ac61d9feb0975398217ccf883dfe4a7f593ff6d5479d3a13b421d12045e5380ce413e4eac7285894a7e083fd
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk8eyRW+HcitzVYb9:pNc/zEOVHFjboOrzV+
TLSH
T102858B1623E901E4F1BBE1BE89779546FA717869533486CF0291811A1F73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 d2e46b983b22ba6a35a17cfdb8165c38495f069ee7ed9d608b73b6795d0c0a28
MD5 851813caff882f4f2790a32a0781f751
SHA1 45f80d20bf424c411d633c198c3e796fcacbb018
SHA512 be0efcbf393065b151bcd072aebe1a38cbb903709ed877c1b84a3e1b19a88fc1f112841cd924ca8a7aadf87e22a8b9f359363149e1748345591aa5e16f4c0d55
SSDEEP 12288:o1Hrkcj5ZI7n4y2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:5cDI8yRW+HcitzVYb9
TLSH
T10605014E277A10F5E06BD07ED6830503D2B2B8A5C72259DF07D8C5795FA3ED8B938A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 1f258255e8cbea14280ff32a406c6542fba79155dcf2e1123563398ebbc88fd1
MD5 bb3082600d114b977d9b868288dae32a
SHA1 52f16ba7ea090f18d76bd8f5b7d41423059d0bac
SHA512 54a2306b61de8487969cdb95581e686f6c878ae83307a24c48ded25fab61b00b2b47ed87a1790070018749e32f46b81ca3743230771517d1871ca4c49b18612b
SSDEEP 12288:CG6kyHy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:rtyHyRW+HcitzVYb9
TLSH
T139F4120667B454D4F9BA16B4EA6346928F34BC14DB2092DF22E0A73D2F337D4B931786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 297dbac46dcd242fc5a20a1bebdfa4d5c05ad3762c66cadf55fb6828a314eb1d
MD5 a4dd556874f6301e53e4769d52caf73d
SHA1 723e88617c0fe32170058b1333d1d011b6f95281
SHA512 1ff3e08d041b17b96ffe4ec6b86fae004ad6e6b8d91ff8517674fa7318ea370fcd5a0132b54be810a92b3d7bc07c5b00960e2faf10d391b7d252cceaefcfdf1b
SSDEEP 24576:OTkNvNnaFeYhJNtmZBmEyRW+HcitzVYb9:OTMwBtOmdoOrzV+
TLSH
T1E055AF6EBBB846E4D1FAC6B4DD238512EA727851073293CB5390C13E0E679D89E35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 23279b619dbffebf1bd7234d6d9f5dfae4d6142a3f823723347c840ff15cbffb
MD5 746ccd0d9d112b53d86d2abebfca6856
SHA1 9271a4e40d07edc62d39c657addd3513b92748ab
SHA512 d49cbd187dcf0008d5dc38af11815780eb45d1046f37c94c12067f58bd01c95ff2cc005ce7af943fbd17f4d00683a1ca068ec84dfec0f97f41e7c19e038b002b
SSDEEP 12288:Ey+6b3IkxjbBzxy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:e6UqjpxyRW+HcitzVYb9
TLSH
T1BAF4124F5BB054E4F4394170E962822386B0BC669775A5EF33DC86398F33AC4A53BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-177-0x000001C9C6960000-0x000001C9C69C6000-memory.dmp

Download

memory/1536-179-0x00007FF659820000-0x00007FF659C37000-memory.dmp

Download

memory/1536-155-0x000001C9C6960000-0x000001C9C69C6000-memory.dmp

Download

memory/1536-154-0x00007FF659820000-0x00007FF659C37000-memory.dmp

Download

memory/1536-156-0x000001C9C6960000-0x000001C9C69C6000-memory.dmp

Download

memory/1984-141-0x0000022434240000-0x00000224342A6000-memory.dmp

Download

memory/1984-140-0x00007FF626D60000-0x00007FF626E0E000-memory.dmp

Download

memory/1984-176-0x00007FF626D60000-0x00007FF626E0E000-memory.dmp

Download

memory/1984-142-0x0000022434240000-0x00000224342A6000-memory.dmp

Download

memory/2000-118-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2000-174-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2000-119-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/2000-124-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/2176-78-0x000001EFAAD50000-0x000001EFAADB6000-memory.dmp

Download

memory/2176-84-0x000001EFAAD50000-0x000001EFAADB6000-memory.dmp

Download

memory/2176-76-0x00007FF6CFA30000-0x00007FF6CFB98000-memory.dmp

Download

memory/2176-77-0x000001EFAAD50000-0x000001EFAADB6000-memory.dmp

Download

memory/2176-86-0x00007FF6CFA30000-0x00007FF6CFB98000-memory.dmp

Download

memory/2404-175-0x00007FF66D930000-0x00007FF66E074000-memory.dmp

Download

memory/2404-132-0x00007FF66D930000-0x00007FF66E074000-memory.dmp

Download

memory/2404-134-0x00000291A4850000-0x00000291A48B6000-memory.dmp

Download

memory/2404-299-0x00000291A4850000-0x00000291A48B6000-memory.dmp

Download

memory/2404-300-0x00007FF66D930000-0x00007FF66E074000-memory.dmp

Download

memory/2404-131-0x00000291A4850000-0x00000291A48B6000-memory.dmp

Download

memory/3208-109-0x00007FF66F7F0000-0x00007FF66F93A000-memory.dmp

Download

memory/3208-111-0x000001DBB2BF0000-0x000001DBB2C56000-memory.dmp

Download

memory/3208-112-0x000001DBB2BF0000-0x000001DBB2C56000-memory.dmp

Download

memory/3208-173-0x00007FF66F7F0000-0x00007FF66F93A000-memory.dmp

Download

memory/3420-102-0x0000025EA15B0000-0x0000025EA1616000-memory.dmp

Download

memory/3420-100-0x0000025EA1680000-0x0000025EA17DD000-memory.dmp

Download

memory/3420-101-0x0000025EA15B0000-0x0000025EA1616000-memory.dmp

Download

memory/3984-29-0x0000025046AF0000-0x0000025046B56000-memory.dmp

Download

memory/3984-27-0x0000025046AF0000-0x0000025046B56000-memory.dmp

Download

memory/3984-26-0x00007FF75F8E0000-0x00007FF75F9A9000-memory.dmp

Download

memory/3984-28-0x0000025046AF0000-0x0000025046B56000-memory.dmp

Download

memory/3984-128-0x00007FF75F8E0000-0x00007FF75F9A9000-memory.dmp

Download

memory/4008-108-0x00007FF7DBDF0000-0x00007FF7DBF13000-memory.dmp

Download

memory/4008-15-0x00007FF7DBDF0000-0x00007FF7DBF13000-memory.dmp

Download

memory/4008-18-0x0000026053F10000-0x0000026053F76000-memory.dmp

Download

memory/4008-16-0x0000026053F10000-0x0000026053F76000-memory.dmp

Download

memory/4072-60-0x00000187C9210000-0x00000187C936D000-memory.dmp

Download

memory/4072-62-0x00000187C94C0000-0x00000187C9526000-memory.dmp

Download

memory/4072-61-0x00000187C94C0000-0x00000187C9526000-memory.dmp

Download

memory/4484-1-0x00000000026E0000-0x0000000002749000-memory.dmp

Download

memory/4484-7-0x00000000026E0000-0x0000000002749000-memory.dmp

Download

memory/4484-6-0x00000000026E0000-0x0000000002749000-memory.dmp

Download

memory/4484-0-0x0000000002770000-0x000000000289E000-memory.dmp

Download

memory/4636-37-0x000001B5532F0000-0x000001B553356000-memory.dmp

Download

memory/4636-35-0x00007FF75F8E0000-0x00007FF75F9A9000-memory.dmp

Download

memory/4636-36-0x000001B5532F0000-0x000001B553356000-memory.dmp

Download

memory/4636-38-0x000001B5532F0000-0x000001B553356000-memory.dmp

Download

memory/4636-139-0x00007FF75F8E0000-0x00007FF75F9A9000-memory.dmp

Download

memory/4684-170-0x00007FF6A31D0000-0x00007FF6A32EA000-memory.dmp

Download

memory/4684-88-0x00007FF6A31D0000-0x00007FF6A32EA000-memory.dmp

Download

memory/4684-90-0x000002120C240000-0x000002120C2A6000-memory.dmp

Download

memory/4684-89-0x000002120C240000-0x000002120C2A6000-memory.dmp

Download

memory/6064-69-0x000001DA96D60000-0x000001DA96DC6000-memory.dmp

Download

memory/6064-68-0x000001DA96AE0000-0x000001DA96C3D000-memory.dmp

Download

memory/6064-70-0x000001DA96D60000-0x000001DA96DC6000-memory.dmp

Download